April 2007 - syslog-ng - lists.balabit.hu

syslog-ng 2.0.x bug - facility(auth) fails to match any messages
by Evan Rempel 21 Apr '07

21 Apr '07

I posted the message below a couple of weeks ago and did not get a response from anyone. Can anyone else confirm that this configuration fails to match the facility(auth) fails to match messages with a facility of auth? Balazs - can you make a comment on why this happens? Evan. -------- Original Message -------- Date: Wed, 28 Mar 2007 13:19:27 -0700 From: Evan Rempel <erempel(a)uvic.ca> Subject: 2.0.x bug - filter(auth) fails to match With the following configuration source local { unix-stream("/dev/log" max-connections(200)); file("/proc/kmsg" log_prefix("kernel: ")); internal(); }; template standard_file { template("$ISODATE $FULLHOST $FACILITY.$LEVEL $PRI $MESSAGE\n"); template_escape(no); }; destination auth.log { file("/var/syslog/auth.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; destination unknown.log { file("/var/syslog/unknown.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; destination test.log { file("/var/syslog/test.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(^slapd); }; # ****** PROBLEM LOG LINE **** log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ****** PROBLEM LOG LINE **** log { source(local); filter(f_auth); destination(auth.log); }; # safegaurd to catch anything missed by other filters log { source(local); destination(unknown.log); flags(fallback); }; all of the log messages with the facility of auth go into the unknown.log file. If I remove the problematic log line (to test.log) or change the order of its filters or change the first filter to be other than f_local1 (even changing the f_local1 filter to match a different facility) then everything works as expected. All of these work fine # ------------- use other than filter f_local1 filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(slapd); }; log { source(local); filter(f_auth); filter(f_ldap); destination(test.log); }; # ------------ comment out the log line filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(slapd); }; # log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ------------------ match facility local0 in the f_local1 filter filter f_auth { facility(auth); }; filter f_local1 { facility(local0); }; filter f_ldap { program(^slapd); }; log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ----------------- make a more complex single filter rather than multiple filter item in the log line filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(^slapd); }; filter f_test { facility(local1) and program(^sldapd); }; log { source(local); filter(f_test); destination(test.log); }; So, how is the first example going wrong? Evan.

2 4

BUG in syslog-ng-1.6.12
by S. Schulz 19 Apr '07

19 Apr '07

Hi, 1) I found a bug in syslog-ng-1.6.12. If i use the MSGONLY macro the first char of the message is missing. Here is the patch: -snip-------------------------------- 426,427c426,428 < colon++; < ofs = (colon - (char *) msg->msg->data); --- > ofs = (colon - (char *) msg->msg->data) + 2; > if (ofs > msg->msg->length) > ofs = msg->msg->length; -snap-------------------------------- 2) And I have an other problem with a regexp in a filter. I want to log all messages that contains the "[ERR]" string to a separate err log. My filter, destination and log looks like this: filter f_usererr { facility(user) and match('\[ERR\]'); }; destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; log { source(s_net); filter(f_usererr); destination(d_usererr); }; What I get is a line like test[1234]:[ERR] fopen failed but also test[1234]:Event 1 or test[1234]:Released So it seems to be that the backslash before the [ is ignored. If I change the filter to filter f_usererr { facility(user) and match('ERR\]'); }; I get only the line test[1234]:[ERR] fopen failed as expected 3) And I have a third problem with creation of a filename based on the IP destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; The created filename is "/var/log/bla.err" and the $SOURCEIP is missing If I change the destination to destination d_usererr {file("/var/log/$SOURCEIP-$PROGRAM.err"); }; the created filename is "/var/log/192.168.1.1-bla.err" as expected Best regards Stefan Schulz -- "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

3 2

Syslog-ng RPM
by steven colaco 19 Apr '07

19 Apr '07

Hello All, I'm a newbie to Syslog-ng. I want to test syslog-ng on RHEL5. Can anyone provide me the RPM format of Syslog-ng. Is eventlog also required to be installed saperately of its included within Syslog-ng. Please provide some Docs links too. Thanks in Adcance, Stevan Colaco __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

syslog-ng dumps core on SLES i586
by Matthur, Ananda (STSD) 19 Apr '07

19 Apr '07

Hi All, I am trying to use syslog-ng (default on SLES) on a SLES 10 i586 machine. When I try to execute a kill -s HUP 'pid-of-syslog-ng', it is crashing, dumping core. Gdb shows the following info: sgmlx1:/ # ls 1 boot core etc lib mnt proc sbin subdomain test usr bin clog dev home media opt root srv sys tmp var sgmlx1:/ # gdb /sbin/syslog-ng core GNU gdb 6.4 Copyright 2005 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i586-suse-linux"...(no debugging symbols found) Using host libthread_db library "/lib/libthread_db.so.1". (no debugging symbols found) Core was generated by `/sbin/syslog-ng'. Program terminated with signal 11, Segmentation fault. warning: Can't read pathname for load map: Input/output error. (no debugging symbols found) Loaded symbols for /sbin/syslog-ng Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x8000f9a6 in do_handle_afinet_dest () from /sbin/syslog-ng (gdb) Looks like it is doing some invalid operation to cause segmentation fault. I tested the same scenario on both ia64 and x86_64 architectures. Segmentation fault occurs only on i586. Is this a known bug in syslog-ng? Is a patch available for this? Thanks and regards, ++++++++++++++++++++++++++++++++++++++ Ananda Matthur MSL Bangalore - 91 80 2205 3202 ++++++++++++++++++++++++++++++++++++++

2 1

klogd back for syslog-ng-2.x ?
by stucky 19 Apr '07

19 Apr '07

Guys I haven't touched syslog-ng since I last installed 1.6 2 years ago on RHEL4. I'm trying to upgrade to 2.x and I noticed that the init script for RH you provided in the contrib dir actually starts up syslon-ng and klogd. I thought syslog-ng was a total replacement for syslog including klodg ? I checked the older script I have for version 1.6 and sure enough it doesn't start klogd. I'm confused now as to whether I've been running this the wrong way or if you simply rewrote syslog-ng to rely on klogd again. Can anyone elaborate ? thx -- stucky

2 1

Configure error on AIX
by James B Horwath 17 Apr '07

17 Apr '07

I am trying to get syslog-ng-2.0rc4 running on AIX 5.3 I was able to compile eventlog and libol without any problems. When I configure syslog-ng I am receiving errors I need help with. I get this configuration error: ============================================================================= checking for GLIB... Package glib-2.2 was not found in the pkg-config search path. Perhaps you should add the directory containing `glib-2.2.pc' to the PKG_CONFIG_PATH environment variable No package 'glib-2.2' found configure: error: Package requirements (glib-2.2) were not met: Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables GLIB_CFLAGS and GLIB_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. ================================================================== Checking for glib ============================================= rpm -qa | grep glib glib2-2.2.3-3 rpm -ql glib2-2.2.3-3 | grep -v local /opt/freeware/doc/glib2-2.2.3 /opt/freeware/doc/glib2-2.2.3/AUTHORS /opt/freeware/doc/glib2-2.2.3/COPYING /opt/freeware/doc/glib2-2.2.3/ChangeLog /opt/freeware/doc/glib2-2.2.3/NEWS /opt/freeware/doc/glib2-2.2.3/README /opt/freeware/lib/charset.alias /opt/freeware/lib/libglib-2.0.a /opt/freeware/lib/libgmodule-2.0.a /opt/freeware/lib/libgobject-2.0.a /opt/freeware/lib/libgthread-2.0.a /usr/lib/libglib-2.0.a /usr/lib/libgmodule-2.0.a /usr/lib/libgobject-2.0.a /usr/lib/libgthread-2.0.a =========================================== The code appears to be resident. How do I get around this configuration error? Regards, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1

can't make syslog 2.0.3 on rhel 4 x64_86
by Tom H 12 Apr '07

12 Apr '07

Hi, I get the following error when making syslog 2.0.3 on rhel 4 es x64_86; else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:30:20: libnet.h: No such file or directory In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/root/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-2.0.3' make: *** [all] Error 2

2 1

More then one application running on syslog server
by ashish talati 11 Apr '07

11 Apr '07

Hi, I have more then one applications which generate the logs in the host and all these logs are sent to central server through syslog. I dont know how I can differentiate these logs based on individual application? below are the few logs generated in my local machine for your reference. In that first 2 logs are generated through one application and last log generated through second application. But as you can see all logs have the originating source as the pc196070/pc196070 which is the last 5 digits of my machine's ip address. I want to differentiate the logs coming from different application!! How can it possible?? ...I am blank now what to do? 05/Apr/2007 11:18:36 pc196070/pc196070 DEBUG: - [Thread- 62/Client-0] Response: RESP:0; 05/Apr/2007 11:18:36 pc196070/pc196070 Thread-62/Client-0] received: Enter command 05/Apr/2007 11:18:36 pc196070/pc196070 INFO: -N piListener.Listener - Port 12346 successfully opened. Waiting for connecti... I will appreciate your help. Thank you. B.R. Ash. --------------------------------- Check out what you're missing if you're not on Yahoo! Messenger

1 0

Trouble with switches and syslog-ng
by Jean-Michel Philippon-Nadeau 11 Apr '07

11 Apr '07

Good day everyone, We use syslog-ng to store and organize the logs of our machines (~3900). For every host we have, syslog-ng creates a folder with the hostname or the ip address (if it couldn't determine the hostname) of the machine and then stores the logs. We also have 5 switches that can report logs with standard syslog capabilities (udp on port 514). The problem is that syslog-ng doesn't create the folder for these switches and doesn't store their logs. I made sure there was no network problems by using tcpdump - the packets correctly made it to the central syslog-ng host. Yes, of course, I made sure udp(); was in my source declaration. Does anyone know how I can make sure syslog-ng receives the logs? Thanks for your help. -- Jean-Michel Philippon-Nadeau Centre de Calcul Scientifique

2 5

syslog-ng2 conf path default changed; pkg-plist out of date
by Brian A. Seklecki 10 Apr '07

10 Apr '07

Okay...who broke this: The path in the binary to the default config file has changed but the pkg-list hasn't and aside from the 2.0.2 patch level bump I dont see where else it came from: [seklecki@web05 ~]$ strings /usr/local/sbin/syslog-ng |egrep "\.conf" -f <fname>, --cfgfile=<fname> Set config file name, default=/usr/local/etc/syslog-ng.conf /usr/local/etc/syslog-ng.conf [seklecki@web05 /usr/local/cf]$ sudo bash -x /usr/local/etc/rc.d/syslog-ng restart [...snip...] ++ /usr/local/sbin/syslog-ng -p /var/run/syslog.pid Error opening configuration file; filename='/usr/local/etc/syslog-ng.conf', error='No such file or directory (2)' The work-around for the mean time is: syslog_ng_flags="-f /usr/local/etc/syslog-ng/syslog-ng.conf" I need to see a CVS changelog of certain files, but Balavid doesn't have a cvsweb, viewvc, etc. or public CVS archive? l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 1